#!/bin/bash

{{ ansible_managed | comment }}

ipset restore -! < {{ whitelist_ipset_config_file }}

# IPv4

iptables -N f2b-sshd
iptables -A f2b-sshd -j RETURN
iptables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd

iptables -N enemy_input
iptables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
iptables -N DOCKER-USER
iptables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
iptables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }}  -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 2 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I enemy_input 4 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }}  -j DROP

# IPv6

ip6tables -N f2b-sshd
ip6tables -A f2b-sshd -j RETURN
ip6tables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd

ip6tables -N enemy_input
ip6tables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
ip6tables -N DOCKER-USER
ip6tables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
ip6tables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }}  -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 2 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -I enemy_input 4 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }}  -j DROP